CVE-2026-22729

Spring AI’s AbstractFilterExpressionConverter is vulnerable to a JSONPath injection, where user-controlled input in FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping. This can allow authenticated users to bypass metadata-based access controls and access unautho...

CVE-2026-22729

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper...

CVE-2026-22729: Improper Neutralization of Special Elements used in an Expression Language Statement

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper...

VMware Spring AI Security Vulnerabilities

VMware Spring AI is a development framework by the American company VMware, which integrates artificial intelligence and large language model capabilities into the Spring ecosystem. VMware Spring AI has a security vulnerability; this vulnerability stems from the AbstractFilterExpressionConverter,...

PT-2026-25939

Name of the Vulnerable Software and Affected Versions Spring AI versions prior to 1.0.4 and 1.1.3 Description A JSONPath injection issue exists in Spring AI’s AbstractFilterExpressionConverter. Authenticated users can bypass metadata-based access controls by using crafted filter expressions...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to the AbstractFilterExpressionConverter's handling of operator characters, such as || and &&. This allows authenticated users to bypass metadata-based access controls by supplying arbitrary JSONPath queries to access...

Exploit for Injection in Ghost

CVE-2026-29053 Ghost CMS RCE via jsonpath/static-eval prototy...

Exploit for CVE-2025-1302

Research: jsonpath-plus RCE CVE-2025-1302 Analysis !Securi...

Prototype Pollution

jsonpath is vulnerable to Prototype Pollution. The vulnerability is due to unsafe handling of object paths in the value function within lib/index.js, where attacker-controlled property paths can modify Object.prototype, allowing arbitrary property injection into global objects and potentially...

Security update for golang-github-prometheus-prometheus (critical)

openSUSE security update: security update for golang-github-prometheus-prometheus ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20239-1 Rating: critical References: bsc1257442 bsc1257841 bsc1257897 Cross-References: CVE-2025-61140 CVE-2026-1615...

SUSE CVE-2026-1615

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can...

📄 jsonpath 1.1.1 Prototype Pollution

Proof of concept exploit for a prototype pollution vulnerability in jsonpath version 1.1.1, where unsafe writes to $.constructor.prototype allows attackers to inject arbitrary properties and functions into Object.prototype. By abusing jsonpath.value, an attacker can globally modify object...

jsonpath 1.1.1 Prototype Pollution Scanner

jsonpath version 1.1.1 prototype pollution scanner that checks if a system is vulnerable to CVE-2025-61140 without any actual exploitation...

GHSA-87R5-MP6G-5W5J jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Impact Arbitrary Code Injection Remote Code Execution & XSS: A critical security vulnerability affects all versions of the jsonpath package. The library relies on the static-eval module to evaluate JSON Path expressions but fails to properly sanitize or sandbox the input. This allows an attacker ...

7ghost (>=4.11.0, <=4.11.46), @accordproject/concerto-ui-react (>=0.6.0-alpha.1, <=0.83.1-20200224151908) +272 more potentially affected by CVE-2026-1615 via jsonpath (>=1.0.0, <=1.2.1)

jsonpath NPM version =1.0.0, =4.11.0, =0.6.0-alpha.1, =0.82.10-20200221024018, =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =3.0.129, =4.0.174, =0.11.8, =1.2.5, =1.4.0 and more Source cves: CVE-2026-1615 Source advisory: GHSA-87R5-MP6G-5W5J...

7ghost (>=4.11.0, <=4.11.46), @accordproject/concerto-ui-react (>=0.6.0-alpha.1, <=0.83.1-20200224151908) +272 more potentially affected by CVE-2026-1615 via jsonpath (>=1.0.0, <=1.2.1)

jsonpath NPM version =1.0.0, =4.11.0, =0.6.0-alpha.1, =0.82.10-20200221024018, =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =3.0.129, =4.0.174, =0.11.8, =1.2.5, =1.4.0 and more Source cves: CVE-2026-1615 Source advisory: OSV:GHSA-87R5-MP6G-5W5J...

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Impact Arbitrary Code Injection Remote Code Execution & XSS: A critical security vulnerability affects all versions of the jsonpath package. The library relies on the static-eval module to evaluate JSON Path expressions but fails to properly sanitize or sandbox the input. This allows an attacker ...

CVE-2026-1615

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can...

CVE-2026-1615

CVE-2026-1615 affects the jsonpath family (e.g., org.webjars.npm:jsonpath, jsonpath) with Arbitrary Code Injection due to unsafe evaluation of user-supplied JSON Path expressions. The root cause is use of the static-eval module to process JSON Path input, which is not safe for untrusted data, all...

3d-tiles-tools (>=0.1.0, <=0.1.3), 7ghost (>=4.11.0, <=4.11.46) +536 more potentially affected by CVE-2026-1615 via jsonpath (>=0.1.3, <=1.2.1)

jsonpath NPM version =0.1.3, =0.1.0, =4.11.0, =0.0.11, =0.6.0-alpha.1, =0.82.10-20200221024018, =0.1.27, =1.0.0, =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =5.0.257 and more Source cves: CVE-2026-1615 Source advisory: MEND:CVE-2026-1615...